If reCAPTCHA is confident that this is a real user on a real device it will return a
token with no challenge. Otherwise it will provide a visual/audio challenge to attest
the humanness of the user before returning a token.